Privacy policy

Who this policy covers

Afterlo is responsible for the personal information described in this policy. It covers our website, newsletter signups, directory applications and correspondence with readers and brand contacts. You can reach us at hello@afterlo.com.

You can read the site without creating a reader account. Other websites, retailers and social platforms have their own privacy practices when you follow a link to them. This policy does not cover how those services use your information.

Information we use

• Newsletter details. Your email address, your name if you provide it, the signup location, the consent wording you accepted, your confirmation and subscription status, and the dates of permission changes. The form includes an adult-age confirmation; we do not ask for a date of birth.
• Messages and professional contacts. The name, email address and other details you choose to send with a question, correction or partnership enquiry. For brand enquiries, this can include your organisation, role, website and our correspondence or follow-up notes.
• Technical information. Hosting, email and security services may process your IP address, browser or device details, requested pages, timestamps, delivery events and diagnostic information needed to operate their services.
• Site preferences and staff access. Your chosen light or dark theme is stored in your browser. Authorised staff and signed editorial previews also use limited access cookies.

We do not ask readers for payment details, medical histories or identity documents to read articles or join the newsletter. Please leave those details out of general enquiries.

Why we use it

We use newsletter details to check that you control the address, record your choice and deliver the emails you requested. A brand enquiry or a tag in our contact records does not subscribe you to the newsletter.

We use correspondence to answer questions, investigate corrections, manage professional enquiries and handle privacy requests. Technical information helps us deliver pages, prevent abuse and diagnose failures. Access is limited to the people and providers who need it for these purposes.

Where applicable law requires a legal basis, we rely on your consent for the newsletter, our legitimate interests in responding to enquiries and keeping the service reliable and secure, and legal obligations where records must be retained. You can withdraw newsletter consent at any time.

We do not sell or rent your personal information, share it with advertisers for cross-site targeted advertising, or give a sponsor the subscriber list. We may disclose information where required by law or reasonably necessary to protect people, investigate abuse or defend legal rights.

Service providers and transfers

We use Vercel to host the site, Supabase for private subscription and publishing records, Resend for email delivery, and Sentry for error monitoring. If you allow site analytics, we also use Google Analytics. Our email provider processes messages sent to our contact address. These providers handle information needed to supply their services.

Our error-reporting configuration removes form contents, email addresses, authentication details and private URL values before sending application events. Session replay and performance tracing are disabled. This does not prevent hosting or other providers from processing connection information in their own service logs.

Some published images may load from a separate media host. A direct request to that host can send connection and browser information, with referrer information controlled by the browser and site settings. Following an external link also takes you to a separate service.

Providers may process information in the United States and other countries with different privacy laws. Our database is configured in the United States; that is not a promise that every provider or backup stays in one location. Contact us for information about the providers and any transfer safeguards applicable to your request.

Cookies and browser storage

Newsletter prompts remember when you dismiss them or request a signup email, so we can give you a break from the invitation. These browser preferences contain timestamps, not your email address. A dismissal lasts 14 days and a signup request suppresses the prompt for 30 days; the prompt also appears at most once per browser tab session.

The site saves your theme choice in local storage under afterlo:web-theme:v1. You can clear it in your browser settings; doing so resets the preference.

Staff sign-in and authorised draft previews use access cookies. These are separate from newsletter permission. We do not use advertising cookies or a behavioural advertising profile on the site, and we do not run session recordings.

If you confirm that you are 21 or older, we save the confirmation time in this browser for up to 30 days under afterlo:age-confirmation:v1. We do not ask for your date of birth. Clearing site storage removes this confirmation. It does not subscribe you to email or change your newsletter permission.

The site does not change its behaviour in response to the older Do Not Track browser signal. We do not sell personal information or share it for cross-context behavioural advertising. Browser privacy controls may also block storage, external media or provider requests; some features may then work differently.

Optional site analytics

With your permission, Google Analytics helps us understand visits to published pages, general traffic sources and how people use the site. We count content selections, progress through articles and recipes, jumps to recipe cards and acknowledged newsletter requests. A request count is separate from confirmed subscriptions. The Google tag stays off until you choose to allow analytics. Confirming your age or signing up for the newsletter does not give that permission.

When enabled, analytics uses first-party cookies whose names begin with _ga, along with page, browser and device information. Google receives connection information when your browser contacts its service. Our configuration disables advertising features and Google signals. We send page addresses without query strings or fragments, and do not send newsletter form contents, email addresses or confirmation tokens. Private previews and newsletter confirmation and unsubscribe pages are excluded.

We save your choice for up to 180 days in this browser under afterlo:analytics-consent:v1, and limit analytics cookie duration to 180 days. You can change your choice through Analytics preferences in the footer. Turning analytics off stops future collection and removes these analytics cookies from this browser; it does not automatically erase information already processed by Google. Clearing site storage removes your saved choice and analytics stays off until you allow it again.

Newsletter choices

Submitting the form sends an address-confirmation request. Your address becomes an active subscription only after you confirm. Confirmation links expire after 24 hours. You can ignore a signup you did not request.

Use the unsubscribe link in an Afterlo email to stop the newsletter. We retain permission and opt-out history so we can honour that choice. Submitting the form again does not silently remove an existing opt-out.

Our email provider processes delivery, bounce and complaint events. Depending on its settings, it may also record message opens or link clicks. These signals can be affected by email privacy features and are not proof that a person read a message. We do not use them to make decisions with legal or similarly significant effects about you.

See newsletter privacy for a shorter explanation of signup and withdrawal. You can also email us for help if an unsubscribe link is unavailable.

Directory applications

Business representatives can submit a brand or public store for review. We collect the business details, a representative's name, work email, relationship to the business and permission to publish the reviewed listing. The representative's contact details and our review notes stay private. Only approved business information appears in the directory.

Brands provide states served and a source for that information. Stores provide a public visiting address. Online and home-based brands do not need to publish a residential address. Readers can select a state without sharing their device location; the directory does not request GPS access.

We use application details to check a proposed listing, prevent duplicates, manage corrections and contact the representative about their request. Submitting a business does not subscribe anyone to our newsletter. Supabase stores these records and authorised Afterlo staff review them. Our submission limit uses a keyed hash of the connection address, not a raw IP address in the business record.

We keep application and decision records while needed to review and maintain the listing or address abuse and legal obligations. You can request a correction, withdrawal or deletion through our contact address. Removing a public listing can take up to five minutes to reach cached pages; restricted backups and necessary decision records are separate.

How long we keep information

We keep information for the purpose for which it was collected: to maintain an active subscription, answer an enquiry, manage a professional relationship, investigate a correction or meet a legal requirement. We retain permission and suppression records needed to honour an opt-out and avoid sending unwanted mail. Unsubscribing changes your permission; it does not automatically delete your contact record or optional profile details.

Retention depends on the type of record, ongoing need and applicable obligations. Information may remain in restricted backups or provider logs until those copies are replaced under the provider’s retention process. We do not promise that unsubscribing immediately erases every record. You can ask us to explain, correct or delete information through the contact below.

We use restricted access, server-side credentials and monitoring to protect records. No website or email service can guarantee absolute security.

Your privacy requests

Depending on where you live and the law that applies, you may have rights to access, correct, delete or receive a copy of your information; object to or restrict its use; withdraw consent; or appeal a decision about a request. You may also be able to complain to your local data protection authority. We will not discriminate against you for exercising applicable rights.

Email hello@afterlo.com with “Privacy request” in the subject. Describe what you need and, for subscription requests, use the subscribed address where possible. We may ask for proportionate information to verify that the request concerns you or that you are authorised to act for someone else. Do not send passwords or identity documents unless a secure verification method has been agreed.

We will explain any applicable exception, retained record or appeal route in our response. You can withdraw newsletter consent without making a separate access or deletion request.

Age and sensitive information

Afterlo’s site and newsletter are intended for adults aged 21 and over. They are not directed to children. If you believe a child has provided personal information, contact us so we can investigate and take appropriate action.

Reading an article does not require you to tell us whether you use a product or have a health condition. Please avoid sending sensitive personal or health information when a general question or article link will do.

Changes and contact

We will update the date on this page when this policy changes. For a material change to how subscription information is used, we will provide an appropriate notice and obtain fresh consent where required. A policy update does not itself expand your newsletter permission.

For questions about this policy, email hello@afterlo.com or use the details on our contact page.